Repository navigation
fix(scan): a request to a literal host is not an SSRF - #207
Merged
Merged
Conversation
Third false positive in the same family as #203: a pattern matching the shape of a dangerous call without asking whether the danger is reachable. py-ssrf-outbound-request fires on `urlopen(req)` for any variable `req`, so a Python tool that talks to exactly two fixed APIs was reported twice at high severity: req = urllib.request.Request("https://backboard.railway.com/graphql/v2", data=body) req = urllib.request.Request(f"https://api.supabase.com/v1/{path}") SSRF is control of the destination, not of the path. Neither of those can be steered to the metadata endpoint or to localhost for any input, and the first has no interpolation in it at all. `constantRequestHostGuard` resolves the variable to its assignments in the file and exonerates only when every one of them names a literal host. An interpolated authority (`f"https://{host}/v1"`), a bare variable (`Request(url)`), or a name with no assignment in sight all leave the finding standing, and a name assigned in two functions is exonerated only if both destinations are fixed. Measured on profullstack/cli-tools#103 with the language resolved the way the CLI resolves it -- by shebang, since the file is extensionless: 4 findings -> 2, and the two that go are exactly the two GitHub reported at dev2/dev2-site:136 and :1132. The two that remain are the real interpolated SQL statements.
ThreatCrush Security Scan12 finding(s) HIGH/CRITICAL: 1 | MEDIUM: 6 | LOW: 5
Snippets are redacted; ThreatCrush never prints matched credential material. |
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Third false positive in the same family as #203.
py-ssrf-outbound-requestfires onurlopen(req)for any variablereq, so a Python tool that talks to exactly two fixed APIs was reported twice at high severity:SSRF is control of the destination, not of the path. Neither can be steered to the metadata endpoint or to localhost for any input, and the first has no interpolation in it at all.
constantRequestHostGuardresolves the variable to its assignments in the file and exonerates only when every one of them names a literal host. Still reported, and asserted in the tests:f"https://{host}/v1"Request(url)Measured
On profullstack/cli-tools#103, with the language resolved the way the CLI resolves it (by shebang — the file is extensionless): 4 findings → 2, and the two that go are exactly the two GitHub reported at
dev2/dev2-site:136and:1132. The two that remain are the real interpolated SQL statements.358 tests pass.